What changed
On October 20, 2026, FoxIO published comparative testing of ten HTTP/3/QPACK implementations. Seven had exploitable or crash-inducing resource-accounting weaknesses under the researchers' configurations. Compressed request headers can expand into much larger decoded field collections when implementations fail to enforce a cumulative uncompressed field-size budget early enough. This is a cross-stack disclosure of vulnerabilities, not seven newly discovered October CVEs: some fixes and advisories date to May-July 2026. FoxIO lists quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0 and Wireshark 4.6.2/4.4.12 as fixed for the described header variants. Bun 1.4.3, hyperium h3 and aioquic/mitmproxy were unpatched in the research snapshot. Bun 1.4.4 appeared October 22; its fix status must be checked against current upstream notes rather than inferred from the new version number.
Why it matters
Operators often enable HTTP/3 through a reverse proxy, framework or runtime without knowing which QUIC library performs QPACK decoding. A single unauthenticated client may cause excessive allocation or a worker crash, undermining availability even when network bandwidth limits are in place. Version-specific remediation matters: Cloudflare's quiche advisory confirms a high-severity resource exhaustion flaw fixed in 0.29.3, while quic-go has a distinct trailer-field vulnerability patched later in 0.59.1. The disclosure does not establish credential theft or remote code execution.
Why compressed HTTP/3 headers become a memory problem
QPACK reduces transmitted header size, but an implementation must account for the expanded field list while decoding, not after it has allocated memory. FoxIO found libraries that limited the wire frame, omitted per-field overhead, or accepted effectively unbounded decoded sections. The result is denial of service through disproportionate resource use, not evidence of confidentiality compromise.
Patches are library- and variant-specific
Cloudflare's quiche security advisory confirms the QPACK resource exhaustion and its 0.29.3 patch. The quic-go ecosystem also has a later trailer-field advisory requiring 0.59.1, so simply quoting the earlier 0.57.0 fix can leave a related issue unresolved. Inspect the bundled library version inside applications such as reverse proxies, developer servers and traffic inspection tools.
What to do if the stack is still exposed
Inventory publicly reachable HTTP/3 listeners and their underlying QPACK decoder versions. Upgrade to verified fixed releases, including downstream products that bundle these libraries. Where no fix is available, consider disabling HTTP/3 on the affected service, or enforcing supported decoded-header limits; check fallback HTTP/2 behavior and monitor memory/worker restarts. For mitmproxy, FoxIO documents disabling HTTP/3. Test availability and compatibility after changing transport configuration.